What Every U.S. Employer Should Know About Workplace Privacy

Through the Health Insurance Portability and Accountability Act of 1996 (HIPAA), Congress called on the U.S. Department of Health and Human Services (HHS) to promulgate regulations that would help ensure the privacy and security of health information. The Standards for Privacy of Individually Identifiable Health Information (the Privacy Rule) and the Security Standards (the Security Rule) promulgated pursuant to HIPAA apply to 'covered entities' and limit the ability of such entities to use or disclose protected health information (PHI). The Privacy Rule defines a 'covered entity' as a health plan, health care clearinghouse, or health care provider who transmits health information in electronic form in connection with certain specified transactions. While the Privacy Rule and the Security Rule do not directly apply to employers, the requirements of these rules do apply to ERISA-covered 'group health plans' that are sponsored by many employers.

The Privacy Rule prohibits covered entities from disclosing PHI except where disclosure is: 1) to the individual who is the subject of the PHI; 2) for treatment, payment, or health care operations as defined in the Privacy Rule; 3) authorized by the individual; or 4) specifically permitted without authorization by the individual. The Privacy Rule requires covered entities to adopt written policies and procedures regarding the use and disclosure of PHI that are designed to comply with the Privacy Rule.